#!/usr/bin/python
# Nicholas Albrights Page Download and Virustotal Lookup Tool - 2014-05-13
import json, fileinput, re, hashlib, urllib2
verbose = False
apikey = ""
website = fileinput.input()
def vtlookup(searchstring):
    vturl = "https://www.virustotal.com/vtapi/v2/file/report"
    data = "resource=%s&apikey=%s" % (searchstring, apikey)
    request = urllib2.Request(vturl, data)
    jsondata = urllib2.urlopen(request).readlines()
    for line in jsondata:
    	output = json.loads(line)
    	try: 
    		if (output["positives"]) >= 10:
    			print "[!!] %s is majorly malicious (%s hits) - get the firehose!" % (searchstring, output["positives"])
    		elif (output["positives"]) in range(5,10):
    			print "[!] %s is likely malicious (%s hits). You should probably investigate further." % (searchstring, output["positives"])
    		else:
    			print "[.] %s looks clean (%s hits)." % (searchstring, output["positives"])
    		if verbose is True:
    			for engine, results in output["scans"].items():
    				print "%s\t\t%s" % (engine, results["result"])
    	except: print "[-] No Record Found."

for line in website:
    line = line.strip("\n")
    if re.search("https?://", line, re.I):
    	print "[+] Downloading %s:" % line
    	try: 
    		webreq = urllib2.Request(line, headers={'User-Agent': 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.1;)'})
    		filehash = hashlib.md5(urllib2.urlopen(webreq).read())
    		checkhash = filehash.hexdigest()
    		print "[+] Hash: %s" % checkhash
    		vtlookup(checkhash)
    	except: pass
